3 ms·

Former WOW and D3 player here. Think that majority of players are minors/teenagers with next-to-zero knowledge of what a "root CA" is and what it can do to your

Former WOW and D3 player here. Think that majority of players are minors/teenagers with next-to-zero knowledge of what a "root CA" is and what it can do to your encrypted traffic. I don't understand why Battle.net would do this, but I guess NOW they have to issue a statement about this. Innocent version: oops we made a mistake. Actual version: oops we got caught with our hand in the cookie-jar.

johansch 9y ago
Why in the world would they do this, though? I'm at a loss. Arent' they making lots of money off these poor addicts already?
- AFNobody 9y ago
  There is stuff they do for cheat/crack detection that involve https is the only thing I can think of.
  - nrhk 9y ago
    That must be it, the more intrusive it can be, the better the anti-cheat will preform. I'm sure with Overwatch trying to become legit and the hundreds of millions that will go towards the Overwatch League, they need to ensure a level playing field.
    - deleted 9y ago
      [deleted]
    - skate22 9y ago
      Kickbots in WoW are annoying as hell too.
  - revelation 9y ago
    The first assumption of anti-cheat is that the system you are running on is compromised because someone is trying to cheat. It starts with memory being modified out of order, then code being modified, then syscalls and APIs intercepted, and frankly by now it probably goes all the way up to running a cheat hypervisor, because why would you not. So HTTPS is just adding entropy through waste heat, it achieves nothing, whatever a client is sending or receiving is trivially intercepted after the decryption. Anti-cheat in the game client is all about hiding. WoW had this big thing with their Warden system where they downloaded code from the game server, loaded it into the client at runtime and then had some encrypted communication channel back. It was an utterly pointless waste of time because it was so obvious to anyone looking for an anti-cheat mechanism and trivially defeated. What worked for them in the end was doing an "unintentional" out of bounds/uninitialized memory read when assembling a network packet. It looks completely innocuous looking at it in a disassembler (and you wouldn't notice when it's one of 10000 changes in a big patch) but it just happened to send back some bytes of memory that were patched in a cheating client. By now you would probably skip the in-client cheat detection altogether and just do ML classification on movement/interaction/time data at the server.
    - Fnoord 9y ago
      It is just one of the many defenses they use. For example, when a player makes an in-game screenshot [in WoW], this contains a watermark with the account number of that player. So if someone posts a screenshot how they cleverly exploited in the game, and remove their character name, Blizzard can still easily find out their PII because they have the info linked to the account number which is hidden in the screenshot. And its even hidden in partial screenshots.
- scrollaway 9y ago
  The actual reason they'd do this is a follow up to this thread from @taviso: https://twitter.com/taviso/status/939634523137966080 https://twitter.com/taviso/status/939634523137966080
PeterStuer 9y ago
Small correction. I think that the average WoW player's age is well above 30 at this point.
- dogma1138 9y ago
  That’s assuming that the players who played since 2004 stayed which isn’t the case really. While the entire “gamer” demographic is now considerably older than it was 10-15 years ago on average I don’t think that WoW has an exceptional demographic in this regard. If anecdotal evidence to be used than I would say that WoW probably skews younger now despite being a subscription MMO which tended to attract more adults than teens. Not many 30+ year olds have time for MMOs anymore but we can still log into a CoD or BF multiplayer match over the weekend.
cyansmoker 9y ago
Correction: Innocent version: we did nothing wrong and you are reacting before having even looked at that certificate.

johansch 9y ago

Why in the world would they do this, though? I'm at a loss. Arent' they making lots of money off these poor addicts already?

AFNobody 9y ago
There is stuff they do for cheat/crack detection that involve https is the only thing I can think of.
- nrhk 9y ago
  That must be it, the more intrusive it can be, the better the anti-cheat will preform. I'm sure with Overwatch trying to become legit and the hundreds of millions that will go towards the Overwatch League, they need to ensure a level playing field.
  - deleted 9y ago
    [deleted]
  - skate22 9y ago
    Kickbots in WoW are annoying as hell too.
- revelation 9y ago
  The first assumption of anti-cheat is that the system you are running on is compromised because someone is trying to cheat. It starts with memory being modified out of order, then code being modified, then syscalls and APIs intercepted, and frankly by now it probably goes all the way up to running a cheat hypervisor, because why would you not. So HTTPS is just adding entropy through waste heat, it achieves nothing, whatever a client is sending or receiving is trivially intercepted after the decryption. Anti-cheat in the game client is all about hiding. WoW had this big thing with their Warden system where they downloaded code from the game server, loaded it into the client at runtime and then had some encrypted communication channel back. It was an utterly pointless waste of time because it was so obvious to anyone looking for an anti-cheat mechanism and trivially defeated. What worked for them in the end was doing an "unintentional" out of bounds/uninitialized memory read when assembling a network packet. It looks completely innocuous looking at it in a disassembler (and you wouldn't notice when it's one of 10000 changes in a big patch) but it just happened to send back some bytes of memory that were patched in a cheating client. By now you would probably skip the in-client cheat detection altogether and just do ML classification on movement/interaction/time data at the server.
  - Fnoord 9y ago
    It is just one of the many defenses they use. For example, when a player makes an in-game screenshot [in WoW], this contains a watermark with the account number of that player. So if someone posts a screenshot how they cleverly exploited in the game, and remove their character name, Blizzard can still easily find out their PII because they have the info linked to the account number which is hidden in the screenshot. And its even hidden in partial screenshots.
scrollaway 9y ago
The actual reason they'd do this is a follow up to this thread from @taviso: https://twitter.com/taviso/status/939634523137966080 https://twitter.com/taviso/status/939634523137966080

PeterStuer 9y ago

Small correction. I think that the average WoW player's age is well above 30 at this point.

dogma1138 9y ago
That’s assuming that the players who played since 2004 stayed which isn’t the case really. While the entire “gamer” demographic is now considerably older than it was 10-15 years ago on average I don’t think that WoW has an exceptional demographic in this regard. If anecdotal evidence to be used than I would say that WoW probably skews younger now despite being a subscription MMO which tended to attract more adults than teens. Not many 30+ year olds have time for MMOs anymore but we can still log into a CoD or BF multiplayer match over the weekend.

cyansmoker 9y ago

Correction: Innocent version: we did nothing wrong and you are reacting before having even looked at that certificate.